# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [How Salesforce Eliminated Single-Region Risk and Reduced Downtime Blast Radius at 4B Metrics/Min](https://yomu.fyi/post/how-salesforce-eliminated-single-region-risk-and-reduced-downtime-blas.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Aug 5, 2026

Salesforce redesigned its internal observability platform, Argus, to eliminate single-region failure risks while ingesting approximately 4 billion metrics per minute. Operating out of a single AWS region previously created a global blast radius and generated high cross-region data transfer costs. To mitigate these risks without the prohibitive expense of full multi-region replication, the engineering team implemented a geo-local architecture that processes and stores telemetry closer to its origin across production geographies. A newly introduced federation query layer relies on Elasticsearch mappings to route queries selectively to relevant regional clusters, avoiding broad fan-out. The platform also adopted metadata caching for wildcard queries and implemented HTTP 206 partial-response handling to maintain visibility when individual regions experience downtime.


### [Turn one giant AI-generated pull request to a reviewable stack](https://yomu.fyi/post/turn-one-giant-ai-generated-pull-request-to-a-reviewable-stack.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Julia Muiruri
- Published: Aug 4, 2026

Coding agents often consolidate full-stack features into monolithic pull requests spanning thousands of lines, resulting in delayed reviews and lower feedback quality. To resolve this bottleneck, engineers can decompose comprehensive features into ordered, single-concern layers using GitHub stacked pull requests and the gh-stack CLI extension. Distinct specialized agents handle individual branches—ranging from foundational data access modules up to client interfaces—while CI checks continuously evaluate each layer against the stack base. When reviewers request upstream modifications, running gh stack sync executes a cascading rebase across all dependent branches, preserving commit signatures and keeping the entire pull request chain mergeable.


### [The Software Supply Chain Is Under Siege. Devs Are Still the First Line of Defense](https://yomu.fyi/post/the-software-supply-chain-is-under-siege-devs-are-still-the-first-line.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jin Kim
- Published: Aug 4, 2026

A research report by Omdia examines escalating software supply chain security risks driven by growing dependencies on third-party code, open-source software, and artificial intelligence. Over three-fourths of surveyed organizations experienced a software supply chain incident in the preceding year, with known vulnerabilities in third-party software representing the most common exploit vector. Surveyed respondents ranked AI technology as their top supply chain concern, alongside broader issues involving vulnerability remediation and code composition identification. While shifting security left is a high priority for 98% of organizations, 45% still lack confidence in the robustness of their supply chain defenses. Although secure container libraries and Software Bills of Materials provide measurable mitigation benefits, many organizations only generate inventories on a case-by-case basis.


### [Migrating a Large Flow Monorepo to TypeScript](https://yomu.fyi/post/migrating-a-large-flow-monorepo-to-typescript.md)
- Company: [Yelp](https://yomu.fyi/company/yelp.md)
- Author: Shawn Walton, Software Engineer
- Published: Aug 4, 2026

Yelp migrated a 1.4-million-line JavaScript monorepo from Flow to TypeScript after community support and package ecosystem tooling shifted toward TypeScript. To maintain continuous type safety without code freezes, engineers converted the codebase package by package starting at the deepest internal dependencies. The toolchain used flowts for code conversion and flowgen to turn generated TypeScript declaration files back into Flow-compatible headers for downstream consumers. Webcore dogfooded the tooling across 90 packages, automated tracking through internal metrics, and assisted feature teams with bottleneck conversions. Completed in February 2026, the migration increased overall type coverage from 83.15% to 96.44% and unlocked TypeScript-only tooling.


### [Removing the Security Barrier to Agentforce Adoption](https://yomu.fyi/post/removing-the-security-barrier-to-agentforce-adoption.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Aug 3, 2026

Enterprise AI adoption across regulated industries stalls when internal governance mandates private, dedicated network paths for sensitive data. To eliminate the need for manual VPN tunnels and complex proxy layers, Salesforce re-engineered Private Connect into a multi-cloud networking platform connecting customer environments to Hyperforce services. The Private Connect v2.0 architecture utilizes private links, transit gateways, and direct endpoint routing alongside an automated control plane for rapid Hyperforce regional rollouts. In addition to supporting cross-substrate interconnects for Azure and decoupling endpoint management, the platform incorporates a generic connector framework supporting tools like Snowflake, Databricks, and Kafka. Today, the system provisions secure connectivity in under 30 minutes while processing roughly 120 TB of data and 683 million requests monthly across 15 AWS regions.


### [GEM Training: How Meta Doubled the Efficiency of Its LLM-Scale Ads Foundation Model](https://yomu.fyi/post/gem-training-how-meta-doubled-the-efficiency-of-its-llm-scale-ads-foun.md)
- Company: [Meta](https://yomu.fyi/company/meta.md)
- Published: Aug 3, 2026

Meta's Generative Ads Recommendation Model (GEM) trains across thousands of GPUs using a hybrid architecture featuring trillions of sparse embedding parameters and billions of dense parameters. Standard training infrastructure built for large language models struggles with recommendation-specific workloads characterized by jagged user activity histories, asymmetric attention patterns, and numerical sensitivity. To overcome these bottlenecks, engineering teams introduced custom kernels like Jagged Flash Attention and Generalized Dot-Product Attention alongside MXFP8 mixed-precision execution. Pairing these kernel optimizations with topology-aware 5D parallelism doubled end-to-end training efficiency to 20–25% Model FLOPs Utilization while scaling total training FLOPs fourfold over twelve months.


### [How AI is transforming analytics at Grab](https://yomu.fyi/post/how-ai-is-transforming-analytics-at-grab.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Maanas Prabhakar
- Published: Aug 1, 2026

Grab is restructuring its analytics operations using a five-level AI autonomy ladder, transitioning analysts from manual artifact creation to problem framing and decision governance. The architecture leverages domain-specific systems like Spartan to process natural language queries through certified metric indexes and Scarlet to triage and repair failing data pipelines. To prevent agent hallucinations, ContextIQ manages context lifecycles by automatically updating metric definitions, SQL references, and golden-dataset test cases when instrumentation changes or failures occur. Furthermore, data teams use an internal portal called BriX to configure custom analytics surfaces and automated root-cause analysis commentaries using reusable Model Context Protocol connections. Autonomy scales mechanical query and validation tasks while keeping human oversight focused on canonical metric definitions and strategic sign-offs.


### [Modeling Device Capabilities for Analytics](https://yomu.fyi/post/modeling-device-capabilities-for-analytics.md)
- Company: [Netflix](https://yomu.fyi/company/netflix.md)
- Author: Netflix Technology Blog
- Published: Jul 31, 2026

Netflix supports diverse features, such as 4K streaming, immersive audio, and cloud gaming, across varied hardware platforms. Because hardware constraints like RAM, CPU cores, and display capabilities limit feature support on certain models, understanding device capabilities is crucial for managing user experiences. To address this challenge, Netflix built a comprehensive device capability data model integrated with internal feature flags. The architecture employs a cumulative table to capture the latest state of device capabilities alongside a histogram table tracking 28-day active device counts grouped by model and software version. These datasets power analytical products that evaluate feature reach and inform rollout decisions for capabilities like Netflix Spatial Audio and 4K Ultra HD.


### [Don’t stop early: Case-folding source code at memory speed](https://yomu.fyi/post/don-t-stop-early-case-folding-source-code-at-memory-speed.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Alexander Neubeck
- Published: Jul 31, 2026

GitHub's code search engine, Blackbird, must case-fold over 480TB of source code across 180 million repositories during indexing and query matching. To accelerate this operation on source code that is overwhelmingly ASCII, the engineering team replaced early-exit branching with an unconditional branch-free loop. The implementation tests uppercase ASCII ranges using wrapping arithmetic, modifies bits in place, and detects non-ASCII bytes with an accumulator register tested only after the loop completes. Eliminating data-dependent exits allowed LLVM to generate SIMD instructions and achieve throughput exceeding 45 GiB/s on an Apple M4 processor. The optimized implementation was released as the open-source Rust crate casefold.


### [Now testing: Best comments first](https://yomu.fyi/post/now-testing-best-comments-first.md)
- Company: engineering.tumblr.com
- Author: engineering
- Published: Jul 31, 2026

Tumblr has introduced an experimental comment sorting option called Best comments first for users browsing content on the web platform. This new sorting capability functions directly alongside standard chronological options within the comments view on any individual post. The engineering team designed this feature to help readers discover interesting conversations much more easily while actively demoting spammy comments. The implementation is currently undergoing active live testing and fine-tuning exclusively on web, with engineers soliciting community feedback to improve how it operates. Accompanying engineering records highlight various Hack Day prototypes, including LibreTranslate post translation, keyboard command palettes, and dense multi-column feed views.


### [GenRec: Towards LLM-Native Recommendation at Netflix](https://yomu.fyi/post/genrec-towards-llm-native-recommendation-at-netflix.md)
- Company: [Netflix](https://yomu.fyi/company/netflix.md)
- Author: Netflix Technology Blog
- Published: Jul 30, 2026

Netflix developed GenRec, an LLM-backed recommendation ranker built by adapting an internal foundation model for large-scale personalization. Traditional recommendation stacks rely on thousands of hand-crafted features and specialized architectures that are costly to maintain across diverse content types. To replace manual feature pipelines, GenRec verbalizes user histories, metadata, and contexts into natural-language prompts and trains with multi-objective losses, including catalog-aware ranking and reward-weighted alignment. At inference time, the model executes in prefill-only mode on vLLM without decoding text. In large-scale online A/B testing against a mature production ranker, GenRec achieved statistically significant improvements in short-term and long-term metrics while using fewer labeled examples.


### [How Salesforce Built an Agentic Engineering Enablement Strategy for Thousands of Software Engineers](https://yomu.fyi/post/how-salesforce-built-an-agentic-engineering-enablement-strategy-for-th.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Jul 30, 2026

Salesforce addressed the challenge of scaling agentic engineering across thousands of software developers by focusing on organizational learning rather than tooling. While individual engineers initially developed disparate, uncoordinated workflows, the Technology, People, Innovation, and Learning (TPIL) team unified these approaches into the Proficiency Level (PL) Framework. The framework maps developer growth across four mindset-driven stages: AI-Assisted, AI-Validating, AI-Orchestrating, and AI-Native. To facilitate progress across these stages, TPIL introduced global AI camps, weekly working sessions, and manager coaching guides. Rather than tracking course completions or telemetry scores, Salesforce measured transformation through behavioral indicators, such as shifts toward validating agent output, designing multi-agent workflows, and asking higher-level questions regarding human judgment.


### [The Future of Agentic AI Depends on Openness and Trust. That’s Why Docker Is Joining Nvidia’s Open Secure AI Alliance.](https://yomu.fyi/post/the-future-of-agentic-ai-depends-on-openness-and-trust-that-s-why-dock.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jin Kim
- Published: Jul 30, 2026

Modern discussions surrounding agentic AI increasingly center on whether autonomous systems can be trusted and securely placed at the core of enterprise workflows. While intelligence is generated by underlying models, operational trust depends on the surrounding execution runtime, identity frameworks, governance models, and security boundaries. To address these challenges across an open ecosystem, Docker has joined NVIDIA's Open Secure AI Alliance. This initiative aims to ensure developers can seamlessly route tasks between open-weight and frontier models without rewriting their application architectures or sacrificing control. By extending security and governance into the agent execution environment, the alliance seeks to deliver predictable control as AI agents become fundamental components of software stacks.


### [Your trusted knowledge layer: Introducing Stack Internal's new platform experience](https://yomu.fyi/post/your-trusted-knowledge-layer-introducing-stack-internal-s-new-platform.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Phoebe Sajor, Caroline Thomas
- Published: Jul 30, 2026

Organizations face growing challenges managing fragmented institutional data as AI agents and human workers operate across disparate tools. When agents consume stale or conflicting information, they produce confident errors that require costly human verification. Stack Internal has introduced an AI-native knowledge platform that ingests raw data across sources—including Google Docs, Slack, and Stack Internal communities—and evaluates it for trust, freshness, and authority. The updated platform adds a chat interface featuring response-level confidence labels and provenance cards, along with API and MCP server integrations that enforce identity-aware permission boundaries for AI agents. Engineering leaders can also track internal knowledge usage and high-traffic dependencies across versions via new Swagger API v3 endpoints.


### [Crowdsourced taxonomy verification: A feedback-driven framework for refining knowledge graph relationships via online search interactions](https://yomu.fyi/post/crowdsourced-taxonomy-verification-a-feedback-driven-framework-for-ref.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Junpeng Niu
- Published: Jul 30, 2026

Maintaining accurate Knowledge Graphs in dynamic domains like e-commerce and food delivery is challenging because automated language models frequently hallucinate relationships while manual curation cannot scale. To validate structural taxonomy links continuously, a closed-loop verification framework operationalizes search interfaces by injecting unverified candidate edges as hypotheses into live user traffic. The system uses an exploration-exploitation strategy to place candidate relationships in lower-risk interface slots, tracking contextually anchored micro-interactions such as clicks, dwell times, and purchases. An offline verification engine aggregates these weighted interactions into normalized confidence scores, automatically promoting verified links to permanent graph edges and pruning refuted relationships.


### [Tame Dependabot: Group your updates, slow the cadence, keep security fast](https://yomu.fyi/post/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Bruno Borges
- Published: Jul 29, 2026

Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.


### [Developers are attached to tools because tools encode trust](https://yomu.fyi/post/developers-are-attached-to-tools-because-tools-encode-trust.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Ryan Donovan
- Published: Jul 29, 2026

Traditional developer tools like Vim, Emacs, and IDEs earn trust through predictability, bounded roles, and muscle memory developed over time. In contrast, agentic coding tools operate across the entire software development lifecycle using ambiguous natural language, rapidly generating vast amounts of code that developers do not inherently trust. This influx shifts development bottlenecks from code authoring to code review, validation, and infrastructure cost management. Tooling additions such as automated code reviewers, context managers, and memory systems cannot repair broken software development lifecycles unless organizations actively adapt their culture and workflows. Teams can establish trust in agentic environments by providing explicit contextual specifications, reusing verified components to avoid duplicate implementations, and restricting non-deterministic artificial intelligence to appropriate problem domains.


### [Eval-driven development: Lessons from evaluating GenAI at scale](https://yomu.fyi/post/eval-driven-development-lessons-from-evaluating-genai-at-scale.md)
- Company: [Airbnb](https://yomu.fyi/company/airbnb.md)
- Author: Rohit Girme
- Published: Jul 28, 2026

Airbnb outlines its framework for eval-driven development (EDD), treating GenAI evaluation as a continuous engineering discipline rather than an afterthought. The strategy combines programmatic checks, calibrated LLM-as-a-judge evaluators, and human review to detect subtle quality regressions. By inspecting intermediate agentic execution traces and real-world failure modes, teams ensure generative models remain reliable and aligned with product requirements.


### [Coding Agent Horror Stories: The 29 Million Secret Problem](https://yomu.fyi/post/coding-agent-horror-stories-the-29-million-secret-problem.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jennifer Kohl
- Published: Jul 28, 2026

Compromised versions of the Nx npm package, dubbed the s1ngularity campaign, used a post-install hook to repurpose installed AI coding agents as credential scanners. Because AI command-line interfaces often run with the developer's full user permissions, the malware invoked tools such as Claude Code, Gemini CLI, and Amazon Q with permission-bypass flags to map sensitive files. GitGuardian findings indicate that AI-assisted code leaks secrets at roughly twice the baseline rate, largely because models ingest live credentials into working contexts. Docker Sandboxes addresses this risk by restricting the execution environment to the project workspace and keeping actual credentials on the host. When sandboxed with sbx, agents receive sentinel placeholders, while an egress proxy injects real secrets into outgoing network requests.


### [Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls](https://yomu.fyi/post/build-a-flask-app-with-okta-for-secure-oidc-login-and-authorized-api-c.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Akanksha Bhasin
- Published: Jul 28, 2026

Flask web applications require dedicated mechanisms to authenticate users securely and authorize access to downstream services. Developers can address this by integrating Okta as an OpenID Connect identity provider using the Authlib library. Authlib registers Okta as a remote provider and automates the Authorization Code flow using Proof Key for Code Exchange with SHA-256 code challenge verification. After logging in through Okta and completing the callback route, the Flask web application uses the acquired OAuth 2.0 access token to query a protected backend resource server. This architecture ensures that user credentials remain managed by Okta while client requests to backend API endpoints carry valid, scoped authorization tokens.


[Newer posts](https://yomu.fyi/page/5.md) · [Older posts](https://yomu.fyi/page/7.md)